CVE-2025-30065: Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadata
Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code
Users are recommended to upgrade to version 1.15.1, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.parquet:parquet-avroto a version that resolves this vulnerability.Fixed in 1.15.1 - Upgrade
Upgrade
Apache Parquet Java parquet-avroto a version that resolves this vulnerability.Fixed in 1.15.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30065?
CVE-2025-30065 has been identified with a critical severity due to the potential for arbitrary code execution.
How do I fix CVE-2025-30065?
To fix CVE-2025-30065, upgrade to Apache Parquet version 1.15.1 or later.
Which versions of Apache Parquet are affected by CVE-2025-30065?
Apache Parquet versions 1.15.0 and earlier are affected by CVE-2025-30065.
What specific vulnerability does CVE-2025-30065 address?
CVE-2025-30065 addresses a schema parsing vulnerability in the parquet-avro module.
What could happen if I don't address CVE-2025-30065?
Failure to address CVE-2025-30065 could allow attackers to execute arbitrary code on your system.